---
title: "Critical Avada Builder vulnerability: update to 3.16.2 now"
description: "CVE-2026-97670 (9.1): an Avada form lets anonymous visitors run WordPress actions. Affected versions, security checks and the 3.16.2 patch."
language: "en"
locale: "en-US"
type: "article"
canonical: "https://www.wp-masquerade.com/avada-builder-vulnerability-cve-2026-97670/"
published: "2026-10-19T09:00:00+00:00"
modified: "2026-10-29T07:36:47+00:00"
translations:
  en-US: "https://www.wp-masquerade.com/avada-builder-vulnerability-cve-2026-97670/index.md"
  fr-FR: "https://www.wp-masquerade.com/fr/faille-avada-builder-cve-2026-97670/index.md"
  es-ES: "https://www.wp-masquerade.com/es/vulnerabilidad-avada-builder-cve-2026-97670/index.md"
  de-DE: "https://www.wp-masquerade.com/de/avada-builder-sicherheitsluecke-cve-2026-97670/index.md"
  it-IT: "https://www.wp-masquerade.com/it/vulnerabilita-avada-builder-cve-2026-97670/index.md"
  pt-BR: "https://www.wp-masquerade.com/pt/falha-avada-builder-cve-2026-97670/index.md"
  nl-NL: "https://www.wp-masquerade.com/nl/kwetsbaarheid-avada-builder-cve-2026-97670/index.md"
---

# Critical Avada Builder vulnerability: update to 3.16.2 now

On October 9, 2026, Wordfence disclosed a critical vulnerability in Avada Builder: through a form, an unauthenticated visitor can make WordPress run actions, up to emptying the trash. The patch is in Avada 7.16.2 and Avada Builder 3.16.2.

On October 9, 2026, Wordfence disclosed a critical vulnerability ([CVSS](https://www.wp-masquerade.com/glossary/cvss/) 9.1) in Avada Builder, the plugin that ships with the Avada theme: through an Avada form, an unauthenticated visitor can make WordPress run actions of their choosing, up to permanently deleting everything in the trash. The patch has been available since September 30 (Avada 7.16.2 and Avada Builder 3.16.2), so every Avada site that displays a form should check its version today. This article covers the timeline, the conditions for exploitation, the commands to check your site and what to do next.

## What happened

According to the timeline in the CVE record, published by Wordfence as the assigning authority, ThemeFusion, the developer of Avada, was notified on September 24, 2026 at 10:44 p.m. (Paris time). The vulnerability is credited to researcher Chloe Chamberland and to Argus, Wordfence's automated analysis tool.

Six days later, on September 30, ThemeFusion released Avada 7.16.2, presented as a security update fixing six issues, including a "possible [XSS](https://www.wp-masquerade.com/glossary/xss/) and injection in Avada form submissions and notification emails". The developer thanked Wordfence and Patchstack without citing any CVE number. Avada Builder moved to 3.16.2 in the same release.

Wordfence published its advisory on October 9 at 5:52 p.m. The CVE-2026-97670 record appeared on October 10 at 6:26 a.m., then in the NVD database 50 minutes later. On October 11, the analysis added by CISA rated the vulnerability as follows: exploitation "none", automatable "yes". On October 13, Wordfence disclosed a second unauthenticated vulnerability in the same component (CVE-2026-97471), fixed by the same version.

![Timeline of CVE-2026-97670 in Paris time: September 24, 2026 at 10:44 p.m., Wordfence notifies ThemeFusion; September 30, release of Avada 7.16.2 and Avada Builder 3.16.2 with six security fixes; October 9 at 5:52 p.m., Wordfence discloses the vulnerability, critical, CVSS 9.1, unauthenticated; October 10 at 6:26 a.m., the CVE is published, picked up by NVD 50 minutes later; October 11, CISA notes no exploitation and an automatable attack; October 13, CVE-2026-97471 is published, an unauthenticated data leak also fixed in 3.16.2.](https://www.wp-masquerade.com/media/2026/10/deroule-avada-builder-en.webp)

*The patch came out nine days before the disclosure: sites updated by September 30 were protected before the announcement.*

## Who is affected

Avada Builder (slug `fusion-builder`) is a plugin required by the Avada theme, so it is present on every Avada site. Since it is a commercial product, wordpress.org publishes no install count; in May 2026, BleepingComputer estimated the base at about one million active installations. A site is exposed if all of the following conditions are met:

- Avada Builder version 3.16.1 or earlier;
- at least one published Avada form using the AJAX submission type;
- an email notification whose message contains the `[all_fields]` tag or a field tag, which Wordfence describes as the default configuration. Avada's documentation also states that an empty message sends "the default message with all the form fields".

No account is required and no administrator needs to click anything. A note on versions: the CVE record says "up to 7.16.1", which is the theme's version number, while its own description refers to the check present in version 3.16.1 of the Builder. Patchstack, like Wordfence's data, lists Avada Builder 3.16.1 and earlier.

| CVE | Product | Fixed in | CVSS | Account required | Published |
| --- | --- | --- | --- | --- | --- |
| CVE-2026-97670 | Avada Builder | 3.16.2 | 9.1 (critical) | None | October 9, 2026 |
| CVE-2026-97471 | Avada Builder | 3.16.2 | 5.3 (medium) | None | October 13, 2026 |
| CVE-2026-97340 | Avada theme | 7.16.2 | 6.4 (medium) | Subscriber | October 9, 2026 |
| CVE-2026-84925 | Avada theme | 7.16.2 | 6.1 (medium) | None (victim click) | October 1, 2026 |

*The Avada vulnerabilities fixed by the September 30 release and disclosed since; scores from Wordfence, the assigning authority for all four CVEs.*

CVE-2026-97471 lets an unauthenticated visitor read user metadata (administrators' email addresses, usernames, WooCommerce customer details) through the Instagram element. CVE-2026-97340 is a stored XSS by a mere subscriber through profile fields, and CVE-2026-84925 a reflected XSS through the `lang` parameter.

## How the vulnerability works

Avada Builder offers "dynamic data": tokens placed in content and replaced with a value when the page is displayed (a title, a piece of metadata...). One of them, `{action_hook,...}`, fires a WordPress action, that is, a hook to which WordPress and plugins attach their processing. An administrator can legitimately use it in a layout; a visitor should never be able to.

The problem lies in form notifications. When a visitor submits the form, the notification message inserts the field contents through `[all_fields]` or the field tag, and the resulting text then goes through the dynamic data engine. A token typed into a field is therefore interpreted as if it came from the administrator. According to Wordfence, the safeguard in version 3.16.1 (the `is_content_request_supplied()` function) only looked at the request's `args` parameters, never at the form data (`formData`) read by the public submission endpoint. The result: an anonymous visitor chooses the name of the action that runs, and can fire several per request.

![Six-step diagram: an unauthenticated visitor fills in an Avada form; they slip an action_hook token into a field; the email notification inserts the fields through the all_fields tag; the dynamic data engine interprets the token because the check does not inspect form data; WordPress runs the requested action, several per request; consequence, trash emptied by wp_scheduled_delete or site disrupted by wp_maybe_auto_update.](https://www.wp-masquerade.com/media/2026/10/mecanisme-avada-builder-en.webp)

*The attack path described by Wordfence: inserting the fields into the notification email is what opens the door.*

The consequences described by Wordfence:

- **content destruction**: an anonymous request permanently deleted the posts, pages and comments in the trash by calling `wp_scheduled_delete`, the WordPress task that empties the trash;
- **denial of service**: other actions that are not blocked, such as `wp_maybe_auto_update`, can disrupt the site;
- **privileged writes** if another installed plugin attaches vulnerable processing to an action;
- **"blind" reading** of user or content metadata: the result goes into the email received by the site owner, and the attacker cannot retrieve it through the plugin's channels.

So this is not arbitrary PHP code execution, unlike CVE-2026-18431, fixed at the end of August in 3.16.1: the 9.1 score comes from a high impact on integrity and availability, with no direct data leak. Dr. Web counts it as the fifth unauthenticated Builder vulnerability disclosed since May; [the full history of Avada vulnerabilities](https://www.wp-masquerade.com/avada-theme-security-vulnerabilities/) covers the earlier ones.

## Indicators of compromise and checks

As of this writing, no recognized source documents any exploitation: CISA noted "none" on October 11, the vulnerability is not in its KEV catalog, and according to Dr. Web neither Wordfence nor CISA reported attacks as of October 12. Neither Wordfence nor ThemeFusion has published indicators of compromise. The checks below are therefore common-sense checks, not an official list.

Start with the installed versions:

```
wp theme list --fields=name,version,status
wp plugin list --fields=name,version,status
wp plugin get fusion-builder --field=version
```

You should see 3.16.2 or later for `fusion-builder` and 7.16.2 or later for the theme. The `wp plugin verify-checksums` command does not work here: Avada Builder is not distributed on wordpress.org. Next:

- **The trash**: count its contents with `wp post list --post_type=any --post_status=trash --format=count` and `wp comment list --status=trash --format=count`. An empty trash when it held recent items deserves a comparison with your latest backup (WordPress also empties it on its own, after 30 days by default).
- **Notification emails and form entries**: a field containing `{action_hook` or other tokens in curly braces signals an attempt.
- **Server logs**: a burst of POST requests to `/wp-admin/admin-ajax.php` coming from form pages, at a time when you normally receive nothing.
- **Accounts**: `wp user list --role=administrator`, in case another plugin offered a privileged write.
- **Files**, especially if the site was still on Builder 3.16 or earlier at the time of the August vulnerability: `wp core verify-checksums` and `find wp-content -name "*.php" -mtime -30` for PHP files modified in the last 30 days.

## What to do now

- **Update Avada to 7.16.2 and Avada Builder to 3.16.2**, both together. According to Avada's documentation, registration with the purchase code is required to receive updates; Dr. Web points out that only registered installations get the automatic update. An unregistered site must be updated manually.
- **If you cannot update right away**, Dr. Web recommends removing field tags from notification messages. Write fixed text rather than emptying the field, since an empty message falls back to all fields by default. Unpublishing the forms is the safest option.
- **If content has disappeared**, restore it from an earlier backup.
- **Keys and passwords**: this vulnerability does not directly expose the site's secrets. However, if the site ran an old Builder for a long time, treat it as potentially compromised: regenerate the keys in `wp-config.php` (`wp config shuffle-salts`), change administrator passwords and revoke application passwords, scan the files and follow our [guide to cleaning up a hacked site](https://www.wp-masquerade.com/clean-hacked-wordpress-site/).

## Reducing exposure next time

- Turn on automatic updates for security releases and, for Avada, keep the license registered: without it, the patch never arrives.
- Subscribe to vulnerability alerts and monitoring that also cover your commercial products, and keep track of pending updates across all your sites.
- Keep accounts and permissions to the strict minimum (roles and least privilege).
- Keep regular, off-server, tested backups: they are the only remedy for permanent deletion.
- A [web application firewall](https://www.wp-masquerade.com/glossary/waf/) with virtual patches (WAF and virtual patching) can block this kind of request during the window between disclosure and update.

As for WP Masquerade Pro, let's be clear about what it would have done here. The [vulnerability alerts](https://www.wp-masquerade.com/features/vulnerable-plugin-alerts/) compare the installed versions of plugins and themes distributed on wordpress.org with the WPVulnerability.net database every day, and send an [email](https://www.wp-masquerade.com/features/email-alerts/); Avada and Avada Builder are not distributed there, so they are not checked and this vulnerability would not have triggered any alert. The [admin activity log](https://www.wp-masquerade.com/features/administrator-activity-log/) records account creations, role changes and plugin installations, which would bring an unexpected administrator to light, but it only sees what goes through WordPress since it was activated. The [integrity check](https://www.wp-masquerade.com/features/wordpress-integrity-check/) covers core files only. The member area shows the [pending updates and vulnerable sites](https://www.wp-masquerade.com/features/#surveillance) across all your sites. The tool alerts: it does not fix anything and it is not a firewall.

### Key takeaways

- CVE-2026-97670: a critical (9.1) unauthenticated vulnerability in Avada Builder 3.16.1 and earlier, disclosed by Wordfence on October 9, 2026.
- An AJAX Avada form with a notification that inserts the fields, the default configuration, is enough to make WordPress run actions.
- Patch: Avada 7.16.2 and Avada Builder 3.16.2, available since September 30; the license must be registered to receive them.
- No documented exploitation as of October 19, but the attack is rated automatable.
- Until you update: remove field tags from notifications or unpublish the forms.

## Sources

- CVE: CVE-2026-97670, Avada (Fusion) Builder (October 10, 2026) (https://www.cve.org/CVERecord?id=CVE-2026-97670)
- Avada: Version 7.16.2 Security Update (September 30, 2026) (https://avada.com/blog/version-7-16-2-security-update/)
- Avada: How To Set Up Avada Form Notifications (documentation, June 22, 2026) (https://avada.com/documentation/how-to-set-up-form-notifications/)
- CVE: CVE-2026-97471, Avada (Fusion) Builder (October 14, 2026) (https://www.cve.org/CVERecord?id=CVE-2026-97471)

Other sources consulted: further CVE records, official vendor pages, trade press articles, Wordfence and Patchstack databases.

## WordPress security, without the noise

One e-mail when something matters: new attacks seen in the wild, plugin updates and practical guides. No spam, unsubscribe in one click.